Privacy Notice

Oakstone Project Advisory Ltd ("Oakstone", "we", "us" or "our") respects your privacy and is committed to protecting your personal information. This Privacy Notice explains how we collect, use, store, share and protect personal information when you visit our website, contact us, make an enquiry, engage our professional services or otherwise interact with Oakstone.

This notice applies to clients, prospective clients, suppliers, contractors, consultants, professional advisers, project stakeholders, website visitors and other business contacts.

1. Who we are

Oakstone Project Advisory Ltd is a construction and property consultancy providing professional services which may include Clerk of Works and quality inspection services, lender and development monitoring, Employer's Agent services, construction and project monitoring, technical due diligence, project advisory services and associated professional consultancy services.

For the purposes of applicable UK data protection law, Oakstone Project Advisory Ltd will generally act as the data controller for the personal information described in this notice.

2. Data protection framework

We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations where applicable.

3. Personal information we may collect

Identity and business contact information

• —Name and job title
• —Employer or organisation
• —Business address
• —Email address and telephone number
• —Other professional contact details

Professional and project information

• —Professional role, project role and responsibilities
• —Professional qualifications or memberships where relevant
• —Project correspondence and meeting records
• —Inspection records, progress reports and quality records
• —Drawings, specifications, programmes and project documentation
• —Contractor, consultant and stakeholder information
• —Construction photographs and site records

Financial and transactional information

• —Billing and purchase order details
• —Invoice and payment records
• —Accounting information and transaction references

Website and technical information

• —IP address, browser and device type
• —Operating system and approximate location derived from technical information
• —Pages viewed, date and time of access and referring website
• —Website interaction data and cookie or similar technology identifiers

Project photographs may incidentally include identifiable individuals. Where reasonably practicable, our photography is directed towards construction progress, workmanship, condition, defects and technical matters rather than individuals.

4. Special category personal information

Oakstone does not ordinarily seek to collect sensitive or special category personal information through its website. Please avoid sending sensitive personal information through a general website enquiry unless it is genuinely necessary.

Where such information is received in connection with a project, legal matter, complaint, health and safety matter or professional instruction, we will process it only where an appropriate lawful basis and, where required, an additional legal condition applies.

5. How we collect personal information

Directly from you

For example, when you complete a website enquiry form, email or telephone us, request a fee proposal, appoint Oakstone, attend a meeting, provide project documentation or otherwise communicate with us.

From organisations and project participants

We may receive business and project information from your employer, client organisation, developer, lender, funder, contractor, subcontractor, designer, consultant, managing agent, solicitor, accountant or other project stakeholder.

From publicly available sources

We may obtain legitimate professional or business information from sources such as Companies House, company websites, professional registers, planning portals and professional networking platforms.

Automatically through our website

Certain technical information may be collected automatically through server logs, cookies and similar technologies, subject to applicable consent requirements.

6. How and why we use personal information

Enquiries and proposals

We may use your information to respond to enquiries, understand requirements, arrange meetings, prepare fee proposals and take steps towards entering into a professional appointment. Our lawful basis will ordinarily be steps taken at your request before entering into a contract and/or our legitimate interests in operating and developing our consultancy.

Providing professional services

Where Oakstone is appointed, we may process personal information to administer the appointment, conduct site inspections, monitor construction progress, prepare reports, manage project records, communicate with project participants and provide services within our agreed scope. The lawful basis will generally be performance of a contract and/or our legitimate interests in delivering professional services effectively.

Business administration

We may use personal information to manage client relationships, maintain project records, issue invoices, process payments, operate our business, review service quality and maintain appropriate professional records.

Legal, regulatory, insurance and claims

We may process information where necessary to comply with legal or regulatory obligations, maintain insurance records, establish, exercise or defend legal claims, respond to disputes or complaints and protect our legitimate commercial and professional interests.

Website operation and security

Technical information may be used to operate and protect our website, prevent misuse, diagnose technical issues, understand website performance and improve functionality. Depending on the technology involved, processing may rely on legitimate interests and/or consent.

Business-to-business marketing

Where permitted by law, we may use professional business contact information for relevant B2B communications about Oakstone, our services or professional updates. Where consent is legally required, we will obtain it. You may ask us to stop direct marketing at any time.

7. Our lawful bases for processing

• —Contract: processing is necessary to perform a contract or take steps at your request before entering into a contract.
• —Legal obligation: processing is necessary to comply with an applicable legal requirement.
• —Legitimate interests: processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.
• —Consent: where appropriate, we may rely on consent. Consent can be withdrawn at any time, without affecting the lawfulness of earlier processing.

Our legitimate interests may include operating and developing the consultancy, responding to prospective clients, delivering professional services, communicating with project stakeholders, maintaining professional records, managing commercial risk, maintaining information security and establishing or defending legal claims.

8. Who we may share information with

Oakstone does not sell personal information. Where necessary for legitimate business, professional or legal purposes, information may be shared with:

• —Clients, lenders and funders
• —Developers, contractors, subcontractors, consultants and designers
• —Professional advisers, accountants and solicitors
• —Insurers and insurance brokers
• —Specialist consultants appointed by Oakstone
• —IT, cybersecurity, website hosting, cloud, email, communications, document management and accounting service providers
• —Regulators, courts, law enforcement authorities or public bodies where disclosure is required or permitted by law

Where third parties process personal information on our behalf, we take appropriate steps to ensure that information is handled appropriately and securely.

9. International data transfers

Some technology, cloud, email, software or IT providers may process personal information outside the United Kingdom. Where an international transfer occurs, we will use an appropriate lawful mechanism and safeguards where required, which may include UK adequacy regulations, recognised contractual safeguards, the UK International Data Transfer Agreement, an approved UK Addendum or another lawful transfer mechanism.

10. How long we keep personal information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, taking account of contractual requirements, legal obligations, professional duties, tax and accounting requirements, insurance requirements, applicable limitation periods and potential disputes or claims.

General enquiries

Where an enquiry does not result in an appointment, information will normally be retained for up to 24 months following the last meaningful communication, unless there is a legitimate reason to retain it for longer.

Client and project records

Project and professional records will ordinarily be retained for at least the period necessary to meet contractual, professional, insurance and limitation requirements. This may mean records are retained for six years or longer after completion of an instruction. Records may be kept longer where an appointment is executed as a deed, contractual or insurance requirements specify a longer period, litigation or a dispute is ongoing or reasonably anticipated, or another legitimate legal requirement applies.

Financial records

Accounting and taxation records will be retained for the applicable statutory period.

Marketing and website information

Marketing information may be retained until you unsubscribe, object, or we determine that continued retention is no longer justified. Website and cookie-related information is retained according to the relevant technology duration and our operational requirements.

11. Data security

Oakstone uses appropriate technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, misuse, alteration, disclosure and destruction. Measures may include secure business systems, access controls, multi-factor authentication, secure cloud storage, software updates, backups, controlled document access and confidentiality obligations.

12. Your data protection rights

Depending on the circumstances and subject to applicable legal conditions and exemptions, you may have rights including:

• —The right to be informed about how your information is used
• —The right to request access to personal information we hold about you
• —The right to request correction of inaccurate or incomplete information
• —The right to request deletion in certain circumstances
• —The right to request restriction of processing in certain circumstances
• —The right to object to certain processing
• —The right to data portability in certain circumstances
• —The right to withdraw consent where processing relies on consent
• —Rights relating to automated decision-making where applicable

To exercise a data protection right, please contact Oakstone using the contact details published on our website. We may need to verify your identity before acting on a request. We will respond within the timescales required by applicable law.

13. Automated decision-making

Oakstone does not currently make decisions about website users or clients based solely on automated processing where those decisions produce legal or similarly significant effects. If this changes, this Privacy Notice will be updated as appropriate.

14. Data protection complaints

If you believe Oakstone has not handled your personal information appropriately, please contact us using the contact route published on our website so that we can investigate your concern. We will provide an appropriate means to make a complaint, acknowledge a data protection complaint within 30 days, investigate it appropriately and without undue delay, keep you informed where necessary and communicate the outcome of our investigation.

15. Cookies and similar technologies

Our website may use cookies and similar storage or access technologies. Some are necessary for the website to operate, while others may support analytics, preferences or marketing. Where consent is legally required, we will seek appropriate consent before activating the relevant technologies.

16. Third-party websites

Our website may contain links to third-party websites. Oakstone does not control those websites and is not responsible for their privacy practices. We recommend reviewing the privacy information provided by any third-party website before submitting personal information to it.

17. Children's information

Oakstone's website and professional services are directed towards businesses and professional clients and are not intended for children. We do not intentionally collect personal information relating to children through our website. If you believe information relating to a child has been submitted unnecessarily, please contact us.

18. Changes to this Privacy Notice

We may update this Privacy Notice periodically to reflect changes in legislation, regulatory guidance, our services, business operations, technology, website functionality or information-handling practices. The current version will be published on our website and will show the date of the latest update.

19. Contact

Questions about this Privacy Notice, a data protection rights request or a concern about how Oakstone handles personal information should be submitted using the contact details below.